[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwpNdo3B-2V5feWpcxNNyIyotckZRlLkCz8S3q0QzhcY":3},{"article":4,"iocs":47},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":27,"category":28,"article_tags":31},"70d01021-0ea5-4838-9c40-bcbe2a071914","Microsoft Disrupts EvilTokens Device Code Phishing Service","microsoft-disrupts-eviltokens-device-code-phishing-service-c75e5a","Microsoft seized 50 websites and disabled more than 150 domains as part of a coordinated disruption effort against a phishing-as-a-service platform targeting Microsoft 365 accounts.","Microsoft disrupted EvilTokens, a phishing-as-a-service platform targeting Microsoft 365 accounts, by seizing 50 websites and disabling over 150 domains. The operation targeted the infrastructure used to conduct device code phishing attacks against enterprise users. This coordinated takedown reflects Microsoft's efforts to dismantle high-impact credential theft operations.","Microsoft disrupts EvilTokens phishing service, seizing 50 websites and disabling 150+ domains.",null,"https:\u002F\u002Fwww.darkreading.com\u002Fidentity-access-management-security\u002Fmicrosoft-disrupts-eviltokens-device-code-phishing-service","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblt3163f248ce2f1013\u002F6ab2d46dc8295fafe642a234\u002Fskull_coins-breakermaximus-GettyImages-2092767456.jpg?width=720&quality=80&disable=upscale","2026-09-22T20:02:02+00:00","2026-09-22T22:00:37.853057+00:00",8,[18,21,24],{"name":19,"type":20},"Microsoft","vendor",{"name":22,"type":23},"EvilTokens","campaign",{"name":25,"type":26},"Microsoft 365","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":27,"icon":11,"name":29,"slug":30},"Malware","malware",[32,37,42],{"category":33},{"id":34,"icon":11,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":39,"icon":11,"name":40,"slug":41},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":43},{"id":44,"icon":11,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48],{"type":30,"value":22,"context":49},"Phishing-as-a-service platform targeting Microsoft 365 accounts via device code phishing"]